Skip to content

Create an IBM DataPower Gateway machine

Create an IBM DataPower Gateway machine so Certificate Manager - SaaS can discover and provision the certificates in the gateway's application domains, including the default domain. Certificate Manager - SaaS connects to the gateway's REST Management Interface through a VSatellite.

Before you begin

  • The System Administrator, PKI Administrator, or Resource Owner role. If you have the Resource Owner role, you must own or belong to at least one team.
  • The hostname or IP address of the IBM DataPower Gateway.
  • The REST Management Interface turned on for the gateway, and its port if it isn't 5554.
  • An active VSatellite that can reach the gateway on the REST Management Interface port.
  • A DataPower account that can read the gateway's configuration and status and write to its filestore and configuration objects. Discovery needs the read access, and provisioning needs the write access. The built-in admin account covers both. To sign in with a client certificate instead of a password, you need the certificate and its private key in PEM format.

To create an IBM DataPower Gateway machine

  1. Sign in to Certificate Manager - SaaS.
  2. Click Installations > Machines.
  3. Click New, and then select IBM DataPower Gateway.
  4. On the Properties step, in Name, enter a name for the machine.
  5. For Owning Team, choose the team that owns the machine. System Administrators and PKI Administrators can choose any team. Resource Owners can choose only a team they own or belong to.

  6. For VSatellite, choose a VSatellite that can reach the machine. A VSatellite that's the primary of a high availability group shows its number of active replicas, and Certificate Manager - SaaS can run the machine's operations on any healthy VSatellite in the group.

  7. In DataPower Hostname or IP Address, enter the hostname or IP address of the gateway.

  8. (Optional) In REST Management Port, replace the default, 5554, if the REST Management Interface listens on a different port.
  9. For Authentication Method, choose how Certificate Manager - SaaS signs in to the gateway: Username & Password or Client Certificate (mTLS).

  10. If you chose Username & Password, enter the Admin Username and Admin Password of the DataPower account.

    Note

    Certificate Manager - SaaS encrypts the credentials you enter and doesn't display them again. On the machine's Properties tab, they appear masked. To keep a stored credential when you edit the machine, leave its masked value unchanged. Keep your own secure record of the credentials in case you need them again.

  11. If you chose Client Certificate (mTLS), in Client Certificate (PEM), paste the client certificate, and in Client Private Key (PEM), paste its private key.

  12. (Optional) If the gateway's management certificate is self-signed or isn't otherwise trusted, disable Verify TLS Certificate. DataPower gateways commonly use self-signed management certificates. Verify TLS Certificate is enabled by default. When it's disabled, Certificate Manager - SaaS doesn't verify the gateway's certificate, but the connection is still encrypted.

  13. Click Test Access. After the connection succeeds, click Continue. The Discovery step opens.

    Note

    A successful test confirms that Certificate Manager - SaaS can sign in to the REST Management Interface and read the firmware version and the list of application domains. It doesn't confirm that the account can write to the filestore or configuration objects, which provisioning needs.

  14. (Optional) For Certificate Types to Discover, select the certificate usage types to discover. If you don't select any, discovery finds every type.

    • HTTPS Listeners: certificates in an SSL server profile.
    • Outbound TLS (Client): certificates in an SSL client profile.
    • Signing Credentials: certificates in an identification credential that no SSL profile uses.
    • Trust Anchors (CA Certs): certificates in a validation credential.
    • Management Interfaces: certificates in the SSL server profile of the WebGUI or the REST Management Interface, in the default domain.
    • Unbound Certificates: certificates that no credential references.

  15. (Optional) In Scope to Domain (leave blank for all), enter the name of an application domain to discover only that domain. If you leave it empty, discovery scans the default domain and every enabled application domain. If discovery can't read a domain, it skips that domain and continues with the next one.

  16. (Optional) To skip certificates that have already expired, enable Exclude expired certificates.

    Note

    If the gateway blocks direct filestore downloads, as the DataPower Limited Edition container does, discovery reads each certificate through the gateway's certificate details instead. Discovery skips a certificate it can't read either way.

  17. (Optional) To discover certificates on a schedule, enable Schedule. For Repeat every, choose Day, Week, or Month, and then in At, enter the time. For Week, select the days of the week. For Month, enter the days in Day of month. Times are in Coordinated Universal Time (UTC).

  18. Click Continue. The Provisioning step opens.

  19. (Optional) To provision certificates on a schedule, enable Schedule. For Repeat every, choose Day, Week, or Month, and then in At, enter the time. For Week, select the days of the week. For Month, enter the days in Day of month. Times are in Coordinated Universal Time (UTC).

    Scheduled provisioning pushes only certificates that are queued for deployment, such as renewed certificates, so renewals install during the window you choose.

  20. Click Finish.

What's next?

After you create the machine, provision a certificate to it. You can also run discovery on the machine at any time to track the certificates on your gateway.